CVE-2026-66140
Exim before 4.99.5 allows directory traversal to access files outside of the spool area, and...
8.4 HighFix available
Exim before 4.99.5 allows directory traversal to access files outside of the spool area, and consequently gain privileges, because arguments related to queue-name are mishandled.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
0.39%Up 0.1 points since Jul 24, 2026
What each source reports
CVE List Score used
Exim before 4.99.5 allows directory traversal to access files outside of the spool area, and consequently gain privileges, because arguments related to queue-name are mishandled.
- Record
CVE-2026-66140- CVSS 3.1
- 8.4 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-24
- Updated
- 2026-11-02
EUVDEUVD-2026-48478
Exim before 4.99.5 allows directory traversal to access files outside of the spool area, and consequently gain privileges, because arguments related to queue-name are mishandled.
- Record
EUVD-2026-48478- CVSS 3.1
- 8.4 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-5qxf-w5v2-m3rg
Exim before 4.99.5 allows directory traversal to access files outside of the spool area, and...
Exim before 4.99.5 allows directory traversal to access files outside of the spool area, and consequently gain privileges, because arguments related to queue-name are mishandled.
- Record
GHSA-5qxf-w5v2-m3rg- CVSS 3.1
- 8.4 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-24
- Updated
- 2026-11-02
NVD
Exim before 4.99.5 allows directory traversal to access files outside of the spool area, and consequently gain privileges, because arguments related to queue-name are mishandled.
- Record
CVE-2026-66140- CVSS 3.1
- 8.4 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-24
- Updated
- 2026-11-02
OSVALPINE-CVE-2026-66140
Exim before 4.99.5 allows directory traversal to access files outside of the spool area, and consequently gain privileges, because arguments related to queue-name are mishandled.
- Record
ALPINE-CVE-2026-66140- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
OSVDEBIAN-CVE-2026-66140
Exim before 4.99.5 allows directory traversal to access files outside of the spool area, and consequently gain privileges, because arguments related to queue-name are mishandled.
- Record
DEBIAN-CVE-2026-66140- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 12 moreShow less
OSVUBUNTU-CVE-2026-66140
Exim before 4.99.5 allows directory traversal to access files outside of the spool area, and consequently gain privileges, because arguments related to queue-name are mishandled.
- Record
UBUNTU-CVE-2026-66140- CVSS 3.1
- 8.4 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVCLSA-2026-1787225012 No score
exim: Fix of 2 CVEs
- CVE-2026-66140: restrict named-queue names and require admin for -MC* command-line options
- CVE-2026-66141: do not expand local_part in a pipe transport under force_command
- Record
CLSA-2026-1787225012- Updated
- 2026-11-02
OSVCLSA-2026-1787230875 No score
exim: Fix of 2 CVEs
- CVE-2026-66140: restrict named-queue names and require admin for -MC* command-line options
- CVE-2026-66141: do not expand local_part in a pipe transport under force_command
- Record
CLSA-2026-1787230875- Updated
- 2026-11-02
OSVCLSA-2026-1787315165 No score
exim: Fix of 2 CVEs
- Rebuilt with rebrand to TuxCare ELS
- CVE-2026-66140: fixed upstream in 4.99.5 - restrict names permitted for named-queues
- CVE-2026-66141: fixed upstream in 4.99.5 - do not expand local_part from a .forward file in a pipe transport under force_command
- Record
CLSA-2026-1787315165- Updated
- 2026-11-02
OSVCLSA-2026-1787322589 No score
exim: Fix of 2 CVEs
- CVE-2026-66140: fix directory traversal via mishandled queue-name arguments (local privilege escalation)
- CVE-2026-66141: fix .forward privilege escalation via mishandled force_command for a pipe transport
- Record
CLSA-2026-1787322589- Updated
- 2026-11-02
OSVCLSA-2026-1787328725 No score
Fix CVE(s): CVE-2026-66140, CVE-2026-66141
- SECURITY UPDATE: directory traversal outside the spool area through
mishandled named-queue arguments, leading to privilege escalation
- debian/patches/CVE-2026-66140.patch: add validate_queue_name() and apply it to both command-line sources of a queue name, -MCG <name> and -q[f][f][l]G<name>, rejecting a name that contains '/', is longer than 32 characters, or collides with one of the reserved spool subdirectories input, db, msglog and scan; mark -MC and every -MCx argument as admin-only and refuse them for a non-admin caller
- CVE-2026-66140
- SECURITY UPDATE: .forward privilege escalation caused by expansion of
the pipe command under force_command
- debian/patches/CVE-2026-66141.patch: stop passing addr->local_part through expand_string() in the $address_pipe special case of a pipe transport that has force_command set, so command text supplied by a local user in a .forward file is only dequoted and split into arguments instead of being evaluated with the transport's privileges
- CVE-2026-66141
- Record
CLSA-2026-1787328725- Updated
- 2026-11-02
OSVCLSA-2026-1787398969 No score
exim: Fix of 2 CVEs
- Rebuilt with rebrand to TuxCare ELS
- CVE-2026-66140: fixed upstream in 4.99.5 - restrict names permitted for named-queues
- CVE-2026-66141: fixed upstream in 4.99.5 - do not expand local_part from a .forward file in a pipe transport under force_command
- Record
CLSA-2026-1787398969- Updated
- 2026-11-02
OSVCLSA-2026-1787664471 No score
Fix CVE(s): CVE-2026-66140, CVE-2026-66141
- SECURITY UPDATE: directory traversal via named-queue arguments
- debian/patches/CVE-2026-66140.patch: add validate_queue_name() and apply it to the -MCG and -q[f][f][l]G<name> command-line queue names, rejecting names containing '/', longer than 32 characters, or colliding with the reserved spool subdirectories; restrict -MC and all -MCx arguments to admin users.
- CVE-2026-66140
- SECURITY UPDATE: .forward privilege escalation under force_command
- debian/patches/CVE-2026-66141.patch: stop expanding addr->local_part in a pipe transport under force_command, so a command taken from a user's .forward file is only dequoted and split into argv, never evaluated with the transport's privileges.
- CVE-2026-66141
- Record
CLSA-2026-1787664471- Updated
- 2026-11-02
OSVCLSA-2026-1788259973 No score
exim: Fix of 2 CVEs
- Rebuilt with rebrand to TuxCare ELS
- CVE-2026-66140: fixed upstream in 4.99.5 - restrict names permitted for named-queues
- CVE-2026-66141: fixed upstream in 4.99.5 - do not expand local_part from a .forward file in a pipe transport under force_command
- Record
CLSA-2026-1788259973- Updated
- 2026-11-02
OSVCLSA-2026-1788260209 No score
exim: Fix of 2 CVEs
- Rebuilt with rebrand to TuxCare ELS
- CVE-2026-66140: fixed upstream in 4.99.5 - restrict names permitted for named-queues
- CVE-2026-66141: fixed upstream in 4.99.5 - do not expand local_part from a .forward file in a pipe transport under force_command
- Record
CLSA-2026-1788260209- Updated
- 2026-11-02
OSVROOT-OS-DEBIAN-11-CVE-2026-66140 No score
CVE-2026-66140 in exim4 - Patched by Root
Root has patched CVE-2026-66140 in the exim4 package for Root:Debian:11. Multiple fixed versions available.
- Record
ROOT-OS-DEBIAN-11-CVE-2026-66140- Updated
- 2026-11-02
OSVROOT-OS-DEBIAN-12-CVE-2026-66140 No score
CVE-2026-66140 in exim4 - Patched by Root
Root has patched CVE-2026-66140 in the exim4 package for Root:Debian:12. Multiple fixed versions available.
- Record
ROOT-OS-DEBIAN-12-CVE-2026-66140- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
eximAlpine:v3.24 |
before 4.98.5-r0 | 4.98.5-r0 |
eximTuxCare:OracleLinux:6 From an advisory covering 2 CVEs |
before 4.92.3-3.el6.tuxcare.els9 | 4.92.3-3.el6.tuxcare.els9 |
exim-greylistTuxCare:OracleLinux:6 From an advisory covering 2 CVEs |
before 4.92.3-3.el6.tuxcare.els9 | 4.92.3-3.el6.tuxcare.els9 |
exim-monTuxCare:OracleLinux:6 From an advisory covering 2 CVEs |
before 4.92.3-3.el6.tuxcare.els9 | 4.92.3-3.el6.tuxcare.els9 |
exim-mysqlTuxCare:OracleLinux:6 From an advisory covering 2 CVEs |
before 4.92.3-3.el6.tuxcare.els9 | 4.92.3-3.el6.tuxcare.els9 |
exim-pgsqlTuxCare:OracleLinux:6 From an advisory covering 2 CVEs |
before 4.92.3-3.el6.tuxcare.els9 | 4.92.3-3.el6.tuxcare.els9 |
eximTuxCare:CentOS:6 From an advisory covering 2 CVEs |
before 4.92.3-3.el6.tuxcare.els9 | 4.92.3-3.el6.tuxcare.els9 |
exim-greylistTuxCare:CentOS:6 From an advisory covering 2 CVEs |
before 4.92.3-3.el6.tuxcare.els9 | 4.92.3-3.el6.tuxcare.els9 |
exim-monTuxCare:CentOS:6 From an advisory covering 2 CVEs |
before 4.92.3-3.el6.tuxcare.els9 | 4.92.3-3.el6.tuxcare.els9 |
exim-mysqlTuxCare:CentOS:6 From an advisory covering 2 CVEs |
before 4.92.3-3.el6.tuxcare.els9 | 4.92.3-3.el6.tuxcare.els9 |
Show 55 moreShow less
| Package | Affected | Fixed |
|---|---|---|
exim-pgsqlTuxCare:CentOS:6 From an advisory covering 2 CVEs |
before 4.92.3-3.el6.tuxcare.els9 | 4.92.3-3.el6.tuxcare.els9 |
eximTuxCare:AlmaLinux:9.6 From an advisory covering 2 CVEs |
before 4.99.5-1.el9.tuxcare.els1 | 4.99.5-1.el9.tuxcare.els1 |
exim-greylistTuxCare:AlmaLinux:9.6 From an advisory covering 2 CVEs |
before 4.99.5-1.el9.tuxcare.els1 | 4.99.5-1.el9.tuxcare.els1 |
exim-monTuxCare:AlmaLinux:9.6 From an advisory covering 2 CVEs |
before 4.99.5-1.el9.tuxcare.els1 | 4.99.5-1.el9.tuxcare.els1 |
exim-mysqlTuxCare:AlmaLinux:9.6 From an advisory covering 2 CVEs |
before 4.99.5-1.el9.tuxcare.els1 | 4.99.5-1.el9.tuxcare.els1 |
exim-pgsqlTuxCare:AlmaLinux:9.6 From an advisory covering 2 CVEs |
before 4.99.5-1.el9.tuxcare.els1 | 4.99.5-1.el9.tuxcare.els1 |
eximTuxCare:CentOS:7 From an advisory covering 2 CVEs |
before 4.97.1-1.el7.tuxcare.els4 | 4.97.1-1.el7.tuxcare.els4 |
exim-greylistTuxCare:CentOS:7 From an advisory covering 2 CVEs |
before 4.97.1-1.el7.tuxcare.els4 | 4.97.1-1.el7.tuxcare.els4 |
exim-monTuxCare:CentOS:7 From an advisory covering 2 CVEs |
before 4.97.1-1.el7.tuxcare.els4 | 4.97.1-1.el7.tuxcare.els4 |
exim-mysqlTuxCare:CentOS:7 From an advisory covering 2 CVEs |
before 4.97.1-1.el7.tuxcare.els4 | 4.97.1-1.el7.tuxcare.els4 |
exim-pgsqlTuxCare:CentOS:7 From an advisory covering 2 CVEs |
before 4.97.1-1.el7.tuxcare.els4 | 4.97.1-1.el7.tuxcare.els4 |
exim-sysvinitTuxCare:CentOS:7 From an advisory covering 2 CVEs |
before 4.97.1-1.el7.tuxcare.els4 | 4.97.1-1.el7.tuxcare.els4 |
exim4TuxCare:Ubuntu:20.04 From an advisory covering 2 CVEs |
before 4.93-13ubuntu1.12+tuxcare.els3 | 4.93-13ubuntu1.12+tuxcare.els3 |
exim4-baseTuxCare:Ubuntu:20.04 From an advisory covering 2 CVEs |
before 4.93-13ubuntu1.12+tuxcare.els3 | 4.93-13ubuntu1.12+tuxcare.els3 |
exim4-configTuxCare:Ubuntu:20.04 From an advisory covering 2 CVEs |
before 4.93-13ubuntu1.12+tuxcare.els3 | 4.93-13ubuntu1.12+tuxcare.els3 |
exim4-daemon-heavyTuxCare:Ubuntu:20.04 From an advisory covering 2 CVEs |
before 4.93-13ubuntu1.12+tuxcare.els3 | 4.93-13ubuntu1.12+tuxcare.els3 |
exim4-daemon-lightTuxCare:Ubuntu:20.04 From an advisory covering 2 CVEs |
before 4.93-13ubuntu1.12+tuxcare.els3 | 4.93-13ubuntu1.12+tuxcare.els3 |
exim4-devTuxCare:Ubuntu:20.04 From an advisory covering 2 CVEs |
before 4.93-13ubuntu1.12+tuxcare.els3 | 4.93-13ubuntu1.12+tuxcare.els3 |
eximon4TuxCare:Ubuntu:20.04 From an advisory covering 2 CVEs |
before 4.93-13ubuntu1.12+tuxcare.els3 | 4.93-13ubuntu1.12+tuxcare.els3 |
eximTuxCare:AlmaLinux:9.2 From an advisory covering 2 CVEs |
before 4.99.5-1.el9_2.tuxcare.els1 | 4.99.5-1.el9_2.tuxcare.els1 |
exim-greylistTuxCare:AlmaLinux:9.2 From an advisory covering 2 CVEs |
before 4.99.5-1.el9_2.tuxcare.els1 | 4.99.5-1.el9_2.tuxcare.els1 |
exim-monTuxCare:AlmaLinux:9.2 From an advisory covering 2 CVEs |
before 4.99.5-1.el9_2.tuxcare.els1 | 4.99.5-1.el9_2.tuxcare.els1 |
exim-mysqlTuxCare:AlmaLinux:9.2 From an advisory covering 2 CVEs |
before 4.99.5-1.el9_2.tuxcare.els1 | 4.99.5-1.el9_2.tuxcare.els1 |
exim-pgsqlTuxCare:AlmaLinux:9.2 From an advisory covering 2 CVEs |
before 4.99.5-1.el9_2.tuxcare.els1 | 4.99.5-1.el9_2.tuxcare.els1 |
exim4TuxCare:Ubuntu:18.04 From an advisory covering 2 CVEs |
before 4.90.1-1ubuntu1.10+tuxcare.els7 | 4.90.1-1ubuntu1.10+tuxcare.els7 |
exim4-baseTuxCare:Ubuntu:18.04 From an advisory covering 2 CVEs |
before 4.90.1-1ubuntu1.10+tuxcare.els7 | 4.90.1-1ubuntu1.10+tuxcare.els7 |
exim4-configTuxCare:Ubuntu:18.04 From an advisory covering 2 CVEs |
before 4.90.1-1ubuntu1.10+tuxcare.els7 | 4.90.1-1ubuntu1.10+tuxcare.els7 |
exim4-daemon-heavyTuxCare:Ubuntu:18.04 From an advisory covering 2 CVEs |
before 4.90.1-1ubuntu1.10+tuxcare.els7 | 4.90.1-1ubuntu1.10+tuxcare.els7 |
exim4-daemon-lightTuxCare:Ubuntu:18.04 From an advisory covering 2 CVEs |
before 4.90.1-1ubuntu1.10+tuxcare.els7 | 4.90.1-1ubuntu1.10+tuxcare.els7 |
exim4-devTuxCare:Ubuntu:18.04 From an advisory covering 2 CVEs |
before 4.90.1-1ubuntu1.10+tuxcare.els7 | 4.90.1-1ubuntu1.10+tuxcare.els7 |
eximon4TuxCare:Ubuntu:18.04 From an advisory covering 2 CVEs |
before 4.90.1-1ubuntu1.10+tuxcare.els7 | 4.90.1-1ubuntu1.10+tuxcare.els7 |
eximTuxCare:CentOS:8.5 From an advisory covering 2 CVEs |
before 4.99.5-1.el8.tuxcare.els1 | 4.99.5-1.el8.tuxcare.els1 |
exim-greylistTuxCare:CentOS:8.5 From an advisory covering 2 CVEs |
before 4.99.5-1.el8.tuxcare.els1 | 4.99.5-1.el8.tuxcare.els1 |
exim-monTuxCare:CentOS:8.5 From an advisory covering 2 CVEs |
before 4.99.5-1.el8.tuxcare.els1 | 4.99.5-1.el8.tuxcare.els1 |
exim-mysqlTuxCare:CentOS:8.5 From an advisory covering 2 CVEs |
before 4.99.5-1.el8.tuxcare.els1 | 4.99.5-1.el8.tuxcare.els1 |
exim-pgsqlTuxCare:CentOS:8.5 From an advisory covering 2 CVEs |
before 4.99.5-1.el8.tuxcare.els1 | 4.99.5-1.el8.tuxcare.els1 |
eximTuxCare:CentOS:8.4 From an advisory covering 2 CVEs |
before 4.99.5-1.el8.tuxcare.els1 | 4.99.5-1.el8.tuxcare.els1 |
exim-greylistTuxCare:CentOS:8.4 From an advisory covering 2 CVEs |
before 4.99.5-1.el8.tuxcare.els1 | 4.99.5-1.el8.tuxcare.els1 |
exim-monTuxCare:CentOS:8.4 From an advisory covering 2 CVEs |
before 4.99.5-1.el8.tuxcare.els1 | 4.99.5-1.el8.tuxcare.els1 |
exim-mysqlTuxCare:CentOS:8.4 From an advisory covering 2 CVEs |
before 4.99.5-1.el8.tuxcare.els1 | 4.99.5-1.el8.tuxcare.els1 |
exim-pgsqlTuxCare:CentOS:8.4 From an advisory covering 2 CVEs |
before 4.99.5-1.el8.tuxcare.els1 | 4.99.5-1.el8.tuxcare.els1 |
exim4Debian:12 |
All versions, plus listed versions 4.100-14.100-1~bpo13+14.100-34.100-44.100.1-1 Show 45 moreShow less4.100.1-1~bpo13+14.100.1-24.100~RC1-14.100~RC2-14.100~RC3-14.100~RC3-24.96-154.96-15+deb12u14.96-15+deb12u104.96-15+deb12u24.96-15+deb12u34.96-15+deb12u44.96-15+deb12u54.96-15+deb12u64.96-15+deb12u74.96-15+deb12u84.96-15+deb12u94.96-164.96-174.96-184.96-194.96-204.96-214.96-224.97-14.97-1~hurd.24.97-24.97-34.97-44.97-54.97-64.97-74.97-84.97-8~bpo12+14.97~RC0-14.97~RC0-24.97~RC0-34.97~RC1-14.97~RC1-24.97~RC2-14.97~RC2-24.97~RC3-14.98-14.98-1~bpo12+14.98-2 |
None known |
exim4Debian:13 |
before 4.98.2-1+deb13u4, plus listed versions 4.98.2-14.98.2-1+deb13u14.98.2-1+deb13u24.98.2-1+deb13u3 |
4.98.2-1+deb13u4 |
exim4Debian:14 |
before 4.99.4-2, plus listed versions 4.98.2-14.98.2-1+hurd.14.98.2-24.99-14.99-2 Show 29 moreShow less4.99-34.99-44.99-4~bpo13+14.99-54.99-64.99-6~bpo13+14.99-74.99-7~bpo13+14.99.1-14.99.1-1~bpo13+14.99.1-24.99.1-34.99.1-44.99.1-54.99.1-64.99.2-14.99.2-1~bpo13+14.99.2-24.99.2-2~bpo13+14.99.3-14.99.3-24.99.3-2~bpo13+14.99.4-14.99.4-1~bpo13+14.99.4-2~bpo13+14.99~RC1-14.99~RC2-14.99~RC3-14.99~RC3-2 |
4.99.4-2 |
exim4Root:Debian:11 |
before 4.94.2-7+deb11u6.aikido.1 | 4.94.2-7+deb11u6.aikido.1 |
rootio-exim4Root:Debian:11 |
before 4.94.2-7+deb11u6.aikido.1 | 4.94.2-7+deb11u6.aikido.1 |
exim4Root:Debian:12 |
before 4.96-15+deb12u10.aikido.2 | 4.96-15+deb12u10.aikido.24.96-15+deb12u10.aikido.34.96-15+deb12u10.aikido.4 |
rootio-exim4Root:Debian:12 |
before 4.96-15+deb12u10.aikido.2 | 4.96-15+deb12u10.aikido.24.96-15+deb12u10.aikido.34.96-15+deb12u10.aikido.4 |
exim4Ubuntu:Pro:14.04:LTS |
All versions, plus listed versions 4.80-7ubuntu34.80-7ubuntu44.80-9ubuntu14.80-9ubuntu24.82-3ubuntu1 Show 13 moreShow less4.82-3ubuntu24.82-3ubuntu2.14.82-3ubuntu2.24.82-3ubuntu2.34.82-3ubuntu2.44.82-3ubuntu2.4+esm14.82-3ubuntu2.4+esm24.82-3ubuntu2.4+esm34.82-3ubuntu2.4+esm44.82-3ubuntu2.4+esm64.82-3ubuntu2.4+esm74.82-3ubuntu2.4+esm84.82-3ubuntu2.4+esm9 |
None known |
exim4Ubuntu:Pro:16.04:LTS |
All versions, plus listed versions 4.86-3ubuntu14.86-7ubuntu14.86-7ubuntu24.86-7ubuntu34.86.2-2ubuntu1 Show 15 moreShow less4.86.2-2ubuntu24.86.2-2ubuntu2.14.86.2-2ubuntu2.24.86.2-2ubuntu2.34.86.2-2ubuntu2.44.86.2-2ubuntu2.54.86.2-2ubuntu2.64.86.2-2ubuntu2.6+esm14.86.2-2ubuntu2.6+esm24.86.2-2ubuntu2.6+esm44.86.2-2ubuntu2.6+esm54.86.2-2ubuntu2.6+esm64.86.2-2ubuntu2.6+esm74.86.2-2ubuntu2.6+esm84.86.2-2ubuntu2.6+esm9 |
None known |
exim4Ubuntu:Pro:18.04:LTS |
All versions, plus listed versions 4.89-5ubuntu14.89-9ubuntu14.89-9ubuntu24.89-9ubuntu34.89-9ubuntu4 Show 15 moreShow less4.90.1-1ubuntu14.90.1-1ubuntu1.14.90.1-1ubuntu1.24.90.1-1ubuntu1.34.90.1-1ubuntu1.44.90.1-1ubuntu1.54.90.1-1ubuntu1.84.90.1-1ubuntu1.94.90.1-1ubuntu1.104.90.1-1ubuntu1.10+esm14.90.1-1ubuntu1.10+esm24.90.1-1ubuntu1.10+esm34.90.1-1ubuntu1.10+esm44.90.1-1ubuntu1.10+esm54.90.1-1ubuntu1.10+esm6 |
None known |
exim4Ubuntu:Pro:20.04:LTS |
All versions, plus listed versions 4.92.1-1ubuntu34.92.1-1ubuntu44.93~RC2-1ubuntu14.93-9ubuntu14.93-11ubuntu1 Show 12 moreShow less4.93-12ubuntu14.93-13ubuntu14.93-13ubuntu1.14.93-13ubuntu1.54.93-13ubuntu1.64.93-13ubuntu1.74.93-13ubuntu1.84.93-13ubuntu1.94.93-13ubuntu1.104.93-13ubuntu1.114.93-13ubuntu1.124.93-13ubuntu1.12+esm1 |
None known |
exim4Ubuntu:22.04:LTS |
before 4.95-4ubuntu2.11, plus listed versions 4.94.2-7ubuntu24.95-2ubuntu24.95-4ubuntu14.95-4ubuntu24.95-4ubuntu2.1 Show 9 moreShow less4.95-4ubuntu2.24.95-4ubuntu2.34.95-4ubuntu2.44.95-4ubuntu2.54.95-4ubuntu2.64.95-4ubuntu2.74.95-4ubuntu2.84.95-4ubuntu2.94.95-4ubuntu2.10 |
4.95-4ubuntu2.11 |
exim4Ubuntu:24.04:LTS |
before 4.97-4ubuntu4.7, plus listed versions 4.96-17ubuntu24.96-17ubuntu2.14.97-3ubuntu14.97-4ubuntu14.97-4ubuntu3 Show 7 moreShow less4.97-4ubuntu44.97-4ubuntu4.14.97-4ubuntu4.24.97-4ubuntu4.34.97-4ubuntu4.44.97-4ubuntu4.54.97-4ubuntu4.6 |
4.97-4ubuntu4.7 |
exim4Ubuntu:26.04:LTS |
before 4.99.1-1ubuntu1.4, plus listed versions 4.98.2-1ubuntu24.99-4ubuntu14.99.1-1ubuntu14.99.1-1ubuntu1.14.99.1-1ubuntu1.24.99.1-1ubuntu1.3 |
4.99.1-1ubuntu1.4 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected, aliases, references | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-66140 is a high vulnerability (CVSS 8.4) in Exim, published July 24, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.39%, the 32nd percentile. Fixed in exim 4.98.5-r0.
References
openwall.com/lists/oss-security/2026/07/22/9
nvd.nist.gov/vuln/detail/CVE-2026-66140
github.com/advisories/GHSA-5qxf-w5v2-m3rg
security.alpinelinux.org/vuln/CVE-2026-66140
errata.tuxcare.com/els_os/oraclelinux6els/CLSA-2026-1787225012.html
Show 13 moreShow less
security-tracker.debian.org/tracker/CVE-2026-66140
ubuntu.com/security/CVE-2026-66140
cve.org/CVERecord?id=CVE-2026-66140
exim.org/static/doc/security/EXIM-Security-2026-06-22.1/EXIM-Security-2026-06-22.1.txt
This page doesn't list everything
Left out here: 50 versions. The JSON record has them.